Re: [BUG] RDMA/siw: KASAN: slab-use-after-free in siw_accept

[Guoqing Jiang]

Hi,

On 8/24/26 23:24, Bernard Metzler wrote:
> > I suppose it is necessary to clear qp and cep before release 
> > state_lock since both siw_qp_llp_close and
> > siw_qp_modify->siw_qp_llp_close hold the lock during close cep, 
> > something like
> >
> > @@ -1719,6 +1719,16 @@ int siw_accept(struct iw_cm_id *id, struct 
> > iw_cm_conn_param *params)
> >                             SIW_QP_ATTR_STATE | SIW_QP_ATTR_LLP_HANDLE |
> >                                     SIW_QP_ATTR_ORD | SIW_QP_ATTR_IRD |
> >                                     SIW_QP_ATTR_MPA);
> > +       if (rv) {
> > +               cep->qp = NULL;
> > +               qp->cep = NULL;
> > +               siw_cep_put(cep);
> > +       }
> >          up_write(&qp->state_lock);
> Thanks Guoqing, that should fix it. But even better if we
> goto error_unlock directly and remove the now obsolete
> 'if (rv != 0) goto error' below. 

That is cleaner, thanks for the suggestion.

> Can you pls provide a new patch? 

Sure, will do.

Thanks,
Guoqing